The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large volumes of untrusted data from the web via search and fetch operations as described in Step 4 (Breadth pass) and Step 5 (Depth and verification pass).
Ingestion points: External web content, official documents, and academic papers fetched via search tools and live API/browser inspection.
Boundary markers: The skill lacks explicit instructions for using delimiters or boundary markers to isolate untrusted external content from the agent's internal reasoning.
Capability inventory: The agent has the capability to write research artifacts to the local file system (under .workbench/deep-research/) and perform network operations via web search/fetch tools.
Sanitization: There are no specific instructions for sanitizing or escaping external content before it is synthesized into research notes or artifacts.
[DATA_EXFILTRATION]: The workflow explicitly instructs the agent to inventory and read existing local files to determine what is already known before performing new searches.
Evidence: Step 1 in SKILL.md directs the agent to inspect user-provided notes, spreadsheets, and existing folders such as research/, notes/, analysis/, and docs/.
Context: This behavior is limited to project-related research folders and is a functional requirement for the 'inventory-first' methodology. No evidence of unauthorized access to sensitive system paths (e.g., .ssh, .aws) or automated external exfiltration was found.

deep-research